About

John Wunderlich & Associates is an independent privacy consultancy that has been turning privacy law into working programs for government, health systems, and enterprise clients since 2008.

What the firm does

The practice covers the full range of privacy work an organization needs, not a single specialty: privacy impact assessments and threat risk assessments; privacy program development, from the ground up or as a course correction; breach response planning and management; policy development grounded in the regulatory environment a client actually operates in; and training built around an organization's own people and policies rather than a generic template. For organizations that need the expertise without a full-time hire, the firm also provides outsourced or fractional privacy officer services.

John personally also serves as an expert witness, providing analysis and testimony in privacy-related class actions and arbitrations — including matters involving workplace surveillance technology, biometric data collection, and third-party data access — with reports that have been adopted by arbitrators and courts.

Why clients bring more than one problem

The firm is led by John Wunderlich, whose background spans the regulator's side of the table as well as the client's. Before founding the practice, he spent a decade in operational and governance roles at Ceridian Canada — including as a Six Sigma Black Belt responsible for enterprise-level process improvement — then served as Senior Information Technology and Policy Advisor to the Office of the Information and Privacy Commissioner of Ontario, and later as Director, Privacy at Cancer Care Ontario. Since 2016 he has also served as Chief Privacy Officer for JLINC Labs, a Silicon Valley data-provenance and digital identity company. That range — regulator, health system, enterprise, standards body — is why clients come to the firm for more than one kind of problem, and why engagements tend to move from a single project into an ongoing advisory relationship.

Standards and leadership

John Wunderlich & Associates doesn't just apply privacy standards on a client's behalf — it participates in writing them. John is Vice-Chair of the IEEE P7002 Data Privacy Process Working Group (IEEE Std 7002-2024), a member of the Kantara Initiative's Leadership Council, and chaired the Kantara working group that produced the Requirements for Privacy-Enhancing Mobile Credentials. He holds roles with the Trust Over IP Foundation and the Digital Governance Standards Institute. He is a privacy member of the SickKids Hospital Research Ethics Board and has taught privacy and security courses at the University of Guelph since 2009.

Credentials

Fellow of Information Privacy (FIP), Certified Information Privacy Professional/Canada (CIPP/C), and Certified Information Privacy Manager (CIPM) through the IAPP; Six Sigma Black Belt; MBA from Concordia University's John Molson School of Business; BA (Honours, History) from the University of Manitoba.

John also writes on privacy, digital rights, and the political economy of data at Webistemology.

To discuss a project or engagement, reach out directly at john@wunderlich.ca, or see the full range of consulting services.